CVE-2026-90436 is a critical Remote Code Execution (RCE) vulnerability identified in Confluence Data Center. The vulnerability arises from a critical flaw in the Apache Axis library used by Confluence, allowing potential remote code execution.
The vulnerability specifically affects instances of Confluence Data Center that have the 'Remote API (XML-RPC & SOAP)' feature enabled. This feature was turned off by default starting in Confluence 3.0 and was fully removed in Confluence 10.0.
Atlassian has rated the severity of CVE-2026-90436 as critical, assigning it a CVSS score of 9.3. However, Atlassian Cloud sites are not impacted by this vulnerability.
To mitigate the risk, Atlassian advises users to patch their systems to the latest version or apply a fixed Long Term Support (LTS) version. For those unable to patch immediately, turning off the 'Remote API (XML-RPC & SOAP)' feature is suggested as a temporary measure.
Although exploitation has been reported, Atlassian cannot confirm if any instances have been affected by this vulnerability.